Kit Exploits Non Updated Java Hole

Tuesday, November 29, 2011 @ 02:11 PM gHale

A new exploit kit, packaged with the infamous BlackHole, relies on a just patched security flaw in Java.

All versions of Oracle’s Java are susceptible to the attack, except for the latest variants, but considering the fact users do not rush to update these components, the exploit could be successful against quite a few devices.

These attacks can end up automated, which once placed on a website, can infect the machines of unsuspecting Internet users without much effort.

“Java exploits are notoriously successful when bundled into commercial exploit packs, software kits that can turn a hacked Web site into a virtual minefield for Web users who aren’t keeping up to date with the latest security patches,” said Security researcher Brian Krebs, who discovered the exploit.

Curiously, the Java exploit works on most browsers, except for Google Chrome, which for some reason mitigates attacks launched with the new package.

Krebs said such an attack can also work against Mac OS X operating systems, but so far they have only tested it on Windows platforms.

One hacker that advertised the newest Java exploit is giving it away for free to customers that already purchased the BlackHole kit, but for newcomers, the price is $4,000, plus the cost of the BlackHole license.